WordPress.PHP.DevelopmentFunctions.error_log_var_dump
error log var dump
Development or debugging behavior appears in code that may run in production.
Why It Shows Up
The scan found logging, debugging, path disclosure, `phpinfo()`, error-reporting changes, or similar development-oriented functions.
Why It Matters
Debug output can leak paths, configuration, request data, stack details, or sensitive runtime information.
How to Fix
- Remove temporary debugging calls before release.
- If logging is required, guard it with `WP_DEBUG` or a plugin setting intended for administrators.
- Never show debug details to unauthenticated visitors or normal front-end users.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #51 | CWW Companion | 23 | 307 | 223 | 1k+ | Output is not escaped | ||
| #52 | Auto Post Cleaner | 23 | 715 | 1,378 | 1k+ | Non-prefixed global variable | ||
| #53 | DK PDF – WordPress PDF Generator | 23 | 744 | 335 | 3k+ | Exception output is not escaped | ||
| #54 | FV Flowplayer Video Player | 23 | 1,311 | 1,454 | 20k+ | Output is not escaped | ||
| #55 | Groovy Menu Plugin (Free) | 23 | 1,729 | 283 | 4k+ | Text Domain Mismatch | ||
| #56 | IP Geo Block | 23 | 399 | 589 | 8k+ | Output is not escaped | ||
| #57 | License Manager for WooCommerce | 23 | 129 | 797 | 6k+ | Nonce verification recommended | ||
| #58 | Master Slider – Responsive Touch Slider | 23 | 800 | 408 | 60k+ | Output is not escaped | ||
| #59 | MStore API – Create Native Android & iOS Apps On The Cloud | 23 | 618 | 764 | 3k+ | SQL query is not prepared | ||
| #60 | MyWorks Sync for WooCommerce & QuickBooks Online | 23 | 2,292 | 9,101 | 5k+ | Non-prefixed global variable | ||
| #61 | Next Active Directory Integration | 23 | 683 | 284 | 2k+ | Exception output is not escaped | ||
| #62 | NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization | 23 | 316 | 639 | 90k+ | Output is not escaped | ||
| #63 | Postie | 23 | 408 | 259 | 10k+ | Output is not escaped | ||
| #64 | Pricing Table by Supsystic | 23 | 1,299 | 447 | 10k+ | Non Singular String Literal Domain | ||
| #65 | SecuPress with Simple SSL – Simple and Performant Security | 23 | 1,697 | 1,601 | 40k+ | Non-prefixed global variable | ||
| #66 | Image Optimizer, Resizer and CDN – Sirv | 23 | 616 | 1,004 | 1k+ | Output is not escaped | ||
| #67 | teachPress | 23 | 744 | 1,587 | 2k+ | SQL query is not prepared | ||
| #68 | Cart PDF for WooCommerce | 23 | 531 | 172 | 1k+ | Exception output is not escaped | ||
| #69 | ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin | 23 | 7,880 | 2,199 | 90k+ | Text Domain Mismatch | ||
| #70 | WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses | 23 | 590 | 876 | 500 | Non-prefixed function | ||
| #71 | Lead Form Data Collection to CRM | 23 | 211 | 1,698 | 400 | Non-prefixed global variable | ||
| #72 | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning | 23 | 1,118 | 202 | 30k+ | Missing Translators Comment | ||
| #73 | WPCal.io – Easy Meeting Scheduler | 23 | 694 | 595 | 900 | Direct Query | ||
| #74 | Photo Engine (Media Organizer & Lightroom) | 23 | 252 | 650 | 2k+ | Direct Query | ||
| #75 | A2 Optimized WP – Turbocharge and secure your WordPress site | 24 | 271 | 231 | 60k+ | Missing Arg Domain | ||
| #76 | Anti Spam and list cleaner – AcyChecker | 24 | 462 | 88 | 400 | Output is not escaped | ||
| #77 | AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress | 24 | 5,234 | 1,464 | 7k+ | Output is not escaped | ||
| #78 | Ad Inserter – Ad Manager & AdSense Ads | 24 | 4,260 | 812 | 300k+ | Output is not escaped | ||
| #79 | Affiliates Manager | 24 | 1,268 | 653 | 8k+ | Unsafe printing function | ||
| #80 | Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) | 24 | 1,865 | 1,089 | 1k+ | Text Domain Mismatch | ||
| #81 | Builderall for WordPress | 24 | 4,778 | 1,307 | 1k+ | Text Domain Mismatch | ||
| #82 | Smart Online Order for Clover | 24 | 1,746 | 1,246 | 1k+ | Text Domain Mismatch | ||
| #83 | CM Pop-Up – Create engaging popups to capture attention and boost interaction | 24 | 466 | 408 | 8k+ | Output is not escaped | ||
| #84 | Contact Form by Supsystic | 24 | 1,913 | 633 | 6k+ | Non Singular String Literal Domain | ||
| #85 | Custom CSS | 24 | 703 | 657 | 1k+ | Output is not escaped | ||
| #86 | Dynamic Widgets | 24 | 631 | 812 | 10k+ | Non-prefixed global variable | ||
| #87 | Easy Modal | 24 | 564 | 299 | 7k+ | Unsafe printing function | ||
| #88 | ELEX WooCommerce Request a Quote | 24 | 398 | 266 | 2k+ | Request data is not unslashed | ||
| #89 | EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents | 24 | 711 | 1,588 | 100k+ | Output is not escaped | ||
| #90 | FeedWordPress | 24 | 496 | 319 | 9k+ | Missing Arg Domain | ||
| #91 | Football Pool | 24 | 1,085 | 733 | 1k+ | Output is not escaped | ||
| #92 | Generate Images (AI) – Magic Post Thumbnail | 24 | 1,940 | 1,761 | 6k+ | Non-prefixed global variable | ||
| #93 | Mailjet Email Marketing | 24 | 435 | 206 | 10k+ | Unsafe printing function | ||
| #94 | Newsletter – Send awesome emails from WordPress | 24 | 898 | 2,219 | 200k+ | Non-prefixed global variable | ||
| #95 | Ninja Forms – The Contact Form Builder That Grows With You | 24 | 749 | 1,533 | 600k+ | Nonce verification recommended | ||
| #96 | Participants Database | 24 | 950 | 894 | 7k+ | SQL query is not prepared | ||
| #97 | PDF Generator for WordPress Elementor | 24 | 513 | 271 | 1k+ | Exception output is not escaped | ||
| #98 | reGenerate Thumbnails Advanced | 24 | 220 | 122 | 70k+ | Unsafe printing function | ||
| #99 | SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress | 24 | 239 | 304 | 1k+ | Direct Query | ||
| #100 | Servebolt Optimizer | 24 | 1,958 | 681 | 1k+ | Text Domain Mismatch |
